MICROSOFT has disclosed that a China‑aligned threat actor known as Storm-0940 used ARTEX, a Go‑based agentic AI penetration testing framework, to accelerate a supply‑chain compromise against ConnectWise Cloud Backup. The attackers automated password spraying, reconnaissance, and OAuth application abuse at downstream victims, operating at “machine speed” to target hundreds of organisations across multiple sectors since September 2026.
Microsoft notes that ARTEX allowed the group to abuse applications already granted access, bypassing interactive sign‑ins, while also enabling follow‑on activities such as credential changes and privilege modifications to expand or sustain access.
In the ConnectWise incident, Storm‑0940 automated mass sign‑ins across over 2,250 tenants, roughly 2,900 sign‑in attempts per minute, from 10 to 14 October 2026. Microsoft tallies more than 151,000 failed logon events within that window, with a peak of 2,900 failures per minute on 11 October.
By 15 October 2026, the AI agents had gained control of the identities of multiple ConnectWise cloud applications and began authenticating to customer environments using those stolen app credentials, exploiting the established trust of these apps within tenants. In several cases, ARTEX‑driven activity progressed beyond authentication to Microsoft Graph and directory operations, including application credential changes to establish persistence and identities, groups, and privileged roles.
ConnectWise said it shut services temporarily and began phased restoration, noting the attack extends beyond a single company and highlighting the growing risk of software supply chain compromise via AI‑assisted tooling.